cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 114

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-30198ExploitEPSS 5.5%

    Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.

  2. 4.9CVE-2023-2688EPSS 1.7%

    The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Path Traversal in versions up to, and including, 4.19.1 via the vulnerable parameter wfu_newpath. This allows administrator-level attackers to …

  3. 7.2CVE-2023-3172EPSS 1.2%

    Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.

  4. 8.8CVE-2023-34096ExploitEPSS 63%

    Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an att…

  5. 5.3CVE-2023-34238EPSS 0.9%

    Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when run…

  6. 4.3CVE-2023-29502EPSS 0.5%

    Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.

  7. 7.5CVE-2023-1864EPSS 0.9%

    FANUC ROBOGUIDE-HandlingPRO Versions 9 Rev.ZD and prior is vulnerable to a path traversal, which could allow an attacker to remotely read files on the system running the affected software.

  8. 7.5CVE-2023-33510ExploitEPSS 4.1%

    Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.

  9. 9.8CVE-2020-36728ExploitEPSS 3.1%

    The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full…

  10. 9.8CVE-2023-34409EPSS 1.3%

    In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote us…

  11. 7.8CVE-2023-33747EPSS 0.5%

    CloudPanel v2.2.2 allows attackers to execute a path traversal.

  12. 5.3CVE-2023-33524EPSS 1.0%

    Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact information on the host which contains usernames, e-mail addresses, and other internal information stored …

  13. 6.5CVE-2023-33690EPSS 0.9%

    SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS.

  14. 7.8CVE-2023-3098EPSS 0.7%

    A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulation leads to path traversal: '../filedir'. Attacking locally is a requirement. Th…

  15. 7.5CVE-2023-34407EPSS 1.1%

    OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.

  16. 6.5CVE-2023-28163EPSS 0.8%

    When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Window…

  17. 4.3CVE-2023-25750EPSS 0.5%

    Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox < 111.

  18. 4.9CVE-2023-3031EPSS 0.8%

    Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.

  19. 9.8CVE-2023-29736EPSS 1.2%

    Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internal storage and achieve arbitrary code execution.

  20. 7.5CVE-2023-27640ExploitEPSS 3.6%

    An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter type in the /tshirtecommerce/fonts.php endpoint, to allow a remote attacker …

  21. 7.5CVE-2023-27639ExploitEPSS 3.6%

    An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remo…

  22. 8.1CVE-2023-32714EPSS 43%

    In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk ins…

  23. 5.5CVE-2023-33544EPSS 0.3%

    hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being stored in any location, even leading to file overwrite.

  24. 7.5CVE-2023-29159EPSS 2.0%

    Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.

  25. 10.0CVE-2023-2909EPSS 0.7%

    EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.…

  26. 7.2CVE-2023-2435EPSS 1.1%

    The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.0 via a shortcode attribute. This allows editor-level, and above, attackers to include and execute arbitrary files on the ser…

  27. 7.5CVE-2023-30197EPSS 0.7%

    Incorrect Access Control in the module "My inventory" (myinventory) <= 1.6.6 from Webbax for PrestaShop, allows a guest to download personal information without restriction by performing a path traversal attack.

  28. 7.1CVE-2023-28344EPSS 0.9%

    An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on b…

  29. 9.8CVE-2022-47526EPSS 1.3%

    Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the…

  30. 8.8CVE-2023-33177ExploitEPSS 7.0%

    Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow crea…

  31. 5.3CVE-2022-36243EPSS 0.7%

    Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This i…

  32. 7.5CVE-2023-30196EPSS 0.5%

    Prestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.

  33. 5.3CVE-2022-24632ExploitEPSS 27%

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php view parameter.

  34. 9.8CVE-2022-24629ExploitEPSS 37%

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can u…

  35. 7.5CVE-2021-27825ExploitEPSS 7.8%

    A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-static/ URL.

  36. 7.5CVE-2023-29380EPSS 1.8%

    Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.

  37. 7.2CVE-2023-32676EPSS 0.9%

    Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with in…

  38. 7.2CVE-2023-32317EPSS 0.9%

    Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with in…

  39. 7.5CVE-2023-32315KEVExploitEPSS >99.9%

    Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauth…

  40. 5.3CVE-2023-27311EPSS 0.6%

    NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architecture resolves this issue - obtaining the fix requires redeploying a fresh Connector.

  41. 7.5CVE-2023-2825ExploitEPSS 72%

    An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested…

  42. 6.5CVE-2022-46945ExploitEPSS 4.1%

    Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.

  43. 8.1CVE-2023-28382EPSS 0.9%

    Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server. Affected products and versions are as follows: ESS REC Agent Server Edition for Lin…

  44. 7.2CVE-2023-26216EPSS 0.8%

    The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EB…

  45. 6.5CVE-2023-26215EPSS 0.7%

    The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to read system files that are accessible to the web server. Affected releases are TIBC…

  46. 7.5CVE-2023-31861EPSS 1.1%

    ZLMediaKit 4.0 is vulnerable to Directory Traversal.

  47. 9.8CVE-2023-28413EPSS 2.0%

    Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service (DoS) condition.

  48. 9.8CVE-2023-28408EPSS 1.8%

    Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or cause a denial-of-service (DoS) condition, and obtain sensitive information depending on settings.

  49. 9.8CVE-2023-27507EPSS 1.3%

    MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and execute it.

  50. 9.8CVE-2020-20012EPSS 1.1%

    WebPlus Pro v1.4.7.8.4-01 is vulnerable to Incorrect Access Control.